dev.cocore.compute.provider

cocore.dev

Schema Diff

+117 -0

From

CID
bafyreidhoa6o2qf...
Indexed At
2026-06-17 21:16 UTC
View this version

To

CID
bafyreieycmpeqtn...
Indexed At
2026-07-26 20:05 UTC
View this version

Compatibility Analysis

Breaking Changes Detected

7 breaking changes, 36 non-breaking changes.

Breaking Changes (7)
  • RequiredEdgeAdded RequiredEdgeAdded { vertex_id: "dev.cocore.compute.provider:body.advisorFault", src: "dev.cocore.compute.provider:body.advisorFault", tgt: "dev.cocore.compute.provider:body.advisorFault.message", kind: "prop", name: Some("message") }
  • RequiredEdgeAdded RequiredEdgeAdded { vertex_id: "dev.cocore.compute.provider:body.advisorFault", src: "dev.cocore.compute.provider:body.advisorFault", tgt: "dev.cocore.compute.provider:body.advisorFault.observedAt", kind: "prop", name: Some("observedAt") }
  • RequiredEdgeAdded RequiredEdgeAdded { vertex_id: "dev.cocore.compute.provider:body.advisorFault", src: "dev.cocore.compute.provider:body.advisorFault", tgt: "dev.cocore.compute.provider:body.advisorFault.code", kind: "prop", name: Some("code") }
  • RequiredEdgeAdded RequiredEdgeAdded { vertex_id: "dev.cocore.compute.provider:body.attestationFault", src: "dev.cocore.compute.provider:body.attestationFault", tgt: "dev.cocore.compute.provider:body.attestationFault.code", kind: "prop", name: Some("code") }
  • RequiredEdgeAdded RequiredEdgeAdded { vertex_id: "dev.cocore.compute.provider:body.attestationFault", src: "dev.cocore.compute.provider:body.attestationFault", tgt: "dev.cocore.compute.provider:body.attestationFault.at", kind: "prop", name: Some("at") }
  • RequiredEdgeAdded RequiredEdgeAdded { vertex_id: "dev.cocore.compute.provider:body.attestationFault", src: "dev.cocore.compute.provider:body.attestationFault", tgt: "dev.cocore.compute.provider:body.attestationFault.message", kind: "prop", name: Some("message") }
  • RequiredEdgeAdded RequiredEdgeAdded { vertex_id: "dev.cocore.compute.provider#proBonoPolicy", src: "dev.cocore.compute.provider#proBonoPolicy", tgt: "dev.cocore.compute.provider#proBonoPolicy.mode", kind: "prop", name: Some("mode") }
Non-Breaking Changes (36)
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.defs#tier" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider#proBonoPolicy" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider#proBonoPolicy.dids" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider#proBonoPolicy.dids:items" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider#proBonoPolicy.mode" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider:body.advisorFault" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider:body.advisorFault.code" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider:body.advisorFault.message" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider:body.advisorFault.observedAt" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider:body.attestationFault" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider:body.attestationFault.at" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider:body.attestationFault.code" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider:body.attestationFault.message" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider:body.desiredTier" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider:body.proBono" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider:body.region" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider:body.regionObservedAt" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider:body.regionSource" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider:body.shareLocation" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider:body.tier" }
  • AddedVertex AddedVertex { vertex_id: "dev.cocore.compute.provider:body.toolCalls" }
  • AddedEdge AddedEdge { src: "dev.cocore.compute.provider#proBonoPolicy", tgt: "dev.cocore.compute.provider#proBonoPolicy.dids", kind: "prop", name: Some("dids") }
  • AddedEdge AddedEdge { src: "dev.cocore.compute.provider#proBonoPolicy.dids", tgt: "dev.cocore.compute.provider#proBonoPolicy.dids:items", kind: "items", name: None }
  • AddedEdge AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.advisorFault", kind: "prop", name: Some("advisorFault") }
  • AddedEdge AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.attestationFault", kind: "prop", name: Some("attestationFault") }
  • AddedEdge AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.desiredTier", kind: "prop", name: Some("desiredTier") }
  • AddedEdge AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.proBono", kind: "prop", name: Some("proBono") }
  • AddedEdge AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.region", kind: "prop", name: Some("region") }
  • AddedEdge AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.regionObservedAt", kind: "prop", name: Some("regionObservedAt") }
  • AddedEdge AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.regionSource", kind: "prop", name: Some("regionSource") }
  • AddedEdge AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.shareLocation", kind: "prop", name: Some("shareLocation") }
  • AddedEdge AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.tier", kind: "prop", name: Some("tier") }
  • AddedEdge AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.toolCalls", kind: "prop", name: Some("toolCalls") }
  • AddedEdge AddedEdge { src: "dev.cocore.compute.provider:body.desiredTier", tgt: "dev.cocore.compute.defs#tier", kind: "ref", name: None }
  • AddedEdge AddedEdge { src: "dev.cocore.compute.provider:body.proBono", tgt: "dev.cocore.compute.provider#proBonoPolicy", kind: "ref", name: None }
  • AddedEdge AddedEdge { src: "dev.cocore.compute.provider:body.tier", tgt: "dev.cocore.compute.defs#tier", kind: "ref", name: None }

Migration Guidance

Added Elements

  • AddedVertex { vertex_id: "dev.cocore.compute.defs#tier" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider#proBonoPolicy" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider#proBonoPolicy.dids" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider#proBonoPolicy.dids:items" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider#proBonoPolicy.mode" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider:body.advisorFault" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider:body.advisorFault.code" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider:body.advisorFault.message" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider:body.advisorFault.observedAt" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider:body.attestationFault" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider:body.attestationFault.at" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider:body.attestationFault.code" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider:body.attestationFault.message" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider:body.desiredTier" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider:body.proBono" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider:body.region" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider:body.regionObservedAt" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider:body.regionSource" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider:body.shareLocation" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider:body.tier" }
  • AddedVertex { vertex_id: "dev.cocore.compute.provider:body.toolCalls" }

Additional Notes

  • Breaking: RequiredEdgeAdded { vertex_id: "dev.cocore.compute.provider:body.attestationFault", src: "dev.cocore.compute.provider:body.attestationFault", tgt: "dev.cocore.compute.provider:body.attestationFault.code", kind: "prop", name: Some("code") }
  • Breaking: RequiredEdgeAdded { vertex_id: "dev.cocore.compute.provider:body.attestationFault", src: "dev.cocore.compute.provider:body.attestationFault", tgt: "dev.cocore.compute.provider:body.attestationFault.at", kind: "prop", name: Some("at") }
  • Breaking: RequiredEdgeAdded { vertex_id: "dev.cocore.compute.provider:body.attestationFault", src: "dev.cocore.compute.provider:body.attestationFault", tgt: "dev.cocore.compute.provider:body.attestationFault.message", kind: "prop", name: Some("message") }
  • Breaking: RequiredEdgeAdded { vertex_id: "dev.cocore.compute.provider#proBonoPolicy", src: "dev.cocore.compute.provider#proBonoPolicy", tgt: "dev.cocore.compute.provider#proBonoPolicy.mode", kind: "prop", name: Some("mode") }
  • Breaking: RequiredEdgeAdded { vertex_id: "dev.cocore.compute.provider:body.advisorFault", src: "dev.cocore.compute.provider:body.advisorFault", tgt: "dev.cocore.compute.provider:body.advisorFault.message", kind: "prop", name: Some("message") }
  • Breaking: RequiredEdgeAdded { vertex_id: "dev.cocore.compute.provider:body.advisorFault", src: "dev.cocore.compute.provider:body.advisorFault", tgt: "dev.cocore.compute.provider:body.advisorFault.observedAt", kind: "prop", name: Some("observedAt") }
  • Breaking: RequiredEdgeAdded { vertex_id: "dev.cocore.compute.provider:body.advisorFault", src: "dev.cocore.compute.provider:body.advisorFault", tgt: "dev.cocore.compute.provider:body.advisorFault.code", kind: "prop", name: Some("code") }
  • Non-breaking: AddedEdge { src: "dev.cocore.compute.provider#proBonoPolicy", tgt: "dev.cocore.compute.provider#proBonoPolicy.dids", kind: "prop", name: Some("dids") }
  • Non-breaking: AddedEdge { src: "dev.cocore.compute.provider#proBonoPolicy.dids", tgt: "dev.cocore.compute.provider#proBonoPolicy.dids:items", kind: "items", name: None }
  • Non-breaking: AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.advisorFault", kind: "prop", name: Some("advisorFault") }
  • Non-breaking: AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.attestationFault", kind: "prop", name: Some("attestationFault") }
  • Non-breaking: AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.desiredTier", kind: "prop", name: Some("desiredTier") }
  • Non-breaking: AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.proBono", kind: "prop", name: Some("proBono") }
  • Non-breaking: AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.region", kind: "prop", name: Some("region") }
  • Non-breaking: AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.regionObservedAt", kind: "prop", name: Some("regionObservedAt") }
  • Non-breaking: AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.regionSource", kind: "prop", name: Some("regionSource") }
  • Non-breaking: AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.shareLocation", kind: "prop", name: Some("shareLocation") }
  • Non-breaking: AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.tier", kind: "prop", name: Some("tier") }
  • Non-breaking: AddedEdge { src: "dev.cocore.compute.provider:body", tgt: "dev.cocore.compute.provider:body.toolCalls", kind: "prop", name: Some("toolCalls") }
  • Non-breaking: AddedEdge { src: "dev.cocore.compute.provider:body.desiredTier", tgt: "dev.cocore.compute.defs#tier", kind: "ref", name: None }
  • Non-breaking: AddedEdge { src: "dev.cocore.compute.provider:body.proBono", tgt: "dev.cocore.compute.provider#proBonoPolicy", kind: "ref", name: None }
  • Non-breaking: AddedEdge { src: "dev.cocore.compute.provider:body.tier", tgt: "dev.cocore.compute.defs#tier", kind: "ref", name: None }
1 1 
{
2 2 
  "id": "dev.cocore.compute.provider",
3 3 
  "defs": {
4 4 
    "main": {
5 5 
      "key": "tid",
6 6 
      "type": "record",
7 7 
      "record": {
8 8 
        "type": "object",
9 9 
        "required": [
10 10 
          "machineLabel",
11 11 
          "chip",
12 12 
          "ramGB",
13 13 
          "supportedModels",
14 14 
          "priceList",
15 15 
          "encryptionPubKey",
16 16 
          "attestationPubKey",
17 17 
          "trustLevel",
18 18 
          "createdAt"
19 19 
        ],
20 20 
        "properties": {
21 21 
          "os": {
22 22 
            "type": "string",
23 23 
            "maxLength": 64,
24 24 
            "description": "Operating system + version, e.g. 'macOS 14.5.1'. Helpful for capability-based matchmaking (e.g. CoreML / MLX feature support)."
25 25 
          },
26 26 
          "chip": {
27 27 
            "type": "string",
28 28 
            "maxLength": 64,
29 29 
            "description": "Hardware identifier, e.g. 'Apple M3 Max'."
30 30 
          },
31 + 
          "tier": {
32 + 
            "ref": "dev.cocore.compute.defs#tier",
33 + 
            "type": "ref",
34 + 
            "description": "The highest confidentiality tier this machine can serve, advertised so requesters and matchmakers can pre-filter. ADVISORY: a requester demanding `attested-confidential` MUST still verify the per-job attestation + session handshake and fail closed; this field only avoids routing confidential jobs to machines that cannot serve them. A machine earns `attested-confidential` here only when it runs the measured native engine under a hardware-attested posture. This is the AGENT-published ACHIEVED tier, derived from evidence (never self-declared); see `desiredTier` for the owner's intent. Optional / additive; absent equivalent to `best-effort`."
35 + 
          },
31 36 
          "ramGB": {
32 37 
            "type": "integer",
33 38 
            "minimum": 1
34 39 
          },
35 40 
          "active": {
36 41 
            "type": "boolean",
37 42 
            "default": true,
38 43 
            "description": "Soft delete: false means the machine is retired and should not be matched."
39 44 
          },
40 45 
          "eCores": {
41 46 
            "type": "integer",
42 47 
            "minimum": 0,
43 48 
            "description": "Apple Silicon efficiency-core count, when applicable."
44 49 
          },
45 50 
          "pCores": {
46 51 
            "type": "integer",
47 52 
            "minimum": 0,
48 53 
            "description": "Apple Silicon performance-core count, when applicable."
49 54 
          },
55 + 
          "region": {
56 + 
            "type": "string",
57 + 
            "maxLength": 2,
58 + 
            "minLength": 2,
59 + 
            "description": "Coarse, opt-in country of this machine as an ISO 3166-1 alpha-2 code (e.g. 'US'). AGENT-published and ADVISORY: a self-asserted claim derived from a best-effort public-IP geolocation at serve start, NOT a proof of location — a VPN or proxy moves it, and Apple exposes no signed-location primitive — so a verifier MUST treat it as unverified and MUST NOT gate anything security-relevant on it (same trust posture as `tier`). Present only when the machine's owner has opted into location sharing by setting `shareLocation` (from the console); the agent re-resolves it on every serve (refresh-on-serve) and OMITS it when sharing is off, so opting out drops the value on the next re-publish. Optional / additive; absent ≡ location not shared. A future revision may add finer fields (e.g. integer-rounded lat/lon) additively if needed."
60 + 
          },
61 + 
          "proBono": {
62 + 
            "ref": "#proBonoPolicy",
63 + 
            "type": "ref",
64 + 
            "description": "The owner's pro-bono election for this machine: it serves matching jobs for free — no tokens metered, no exchange cut taken. Owner-written INTENT (set from the console / tray), like `desiredModels`/`active`: the agent reconciles toward it (it serves a matching job pro bono by writing a receipt with `proBono: true`, `price.amount: 0`, and `tokens: { in: 0, out: 0 }`) but NEVER authors it, so it must PRESERVE whatever it finds on every re-publish. Absent ≡ off: the machine meters and bills every job exactly as before. Pro bono is purely ADDITIVE — a requester that does not match the policy is still served as a normal paid job, so opting in never costs the machine paid work. This is the carve-out for explicitly unlimited usage: a matched requester is never metered or charged, and a requester with no balance is admissible against a machine offering them pro bono. Optional / additive; pre-2026-06 agents ignore it."
65 + 
          },
50 66 
          "serving": {
51 67 
            "type": "boolean",
52 68 
            "description": "Liveness flag. The agent sets this true while its serve loop is up, and publishes false on graceful shutdown (it receives SIGTERM when quit/paused/bounced or its schedule window closes), so consumers can show the machine as 'offline' the moment it stops serving rather than leaving it looking idle. Absence means unknown — treat as NOT offline for backward-compat with pre-2026-06 records that never set it. (An ungraceful stop — crash / power loss — can't publish false; a future lastSeenAt heartbeat will cover that case.)"
53 69 
          },
54 70 
          "cpuCores": {
55 71 
            "type": "integer",
56 72 
            "minimum": 1,
57 73 
            "description": "Total CPU core count (logical = physical for Apple Silicon)."
58 74 
          },
59 75 
          "gpuCores": {
60 76 
            "type": "integer",
61 77 
            "minimum": 0,
62 78 
            "description": "Reported GPU core count, when applicable."
63 79 
          },
64 80 
          "createdAt": {
65 81 
            "type": "string",
66 82 
            "format": "datetime"
67 83 
          },
68 84 
          "priceList": {
69 85 
            "type": "array",
70 86 
            "items": {
71 87 
              "ref": "dev.cocore.compute.defs#modelPrice",
72 88 
              "type": "ref"
73 89 
            },
74 90 
            "maxLength": 256,
75 91 
            "minLength": 1,
76 92 
            "description": "Per-model rates the provider advertises. INFORMATIONAL since 2026-05: the active `dev.cocore.compute.exchangePolicy.tokenRate` is canonical for any provider settling through that exchange — providers MUST price receipts at the exchange's tokenRate and SHOULD denormalize the same rate into every priceList entry so the on-PDS view is internally consistent. A future lexicon revision will introduce a per-receipt provider-set override (gated on the exchange's permission), at which point priceList becomes authoritative again. Held required for backward compat with pre-2026-05 readers."
77 93 
          },
94 + 
          "toolCalls": {
95 + 
            "type": "boolean",
96 + 
            "description": "The owner's opt-in to serving tool/function calls on this machine. Owner-written INTENT, set from a management UI (the console's per-machine settings), exactly like `desiredModels`/`desiredTier`/`proBono`/`shareLocation`: the agent reconciles toward it but NEVER authors it, so it must PRESERVE whatever it finds on every re-publish. When `true`, the agent starts each eligible engine with vLLM automatic tool-choice enabled and verifies real tool-call behavior with a forced-tool startup canary before advertising support (per-model, via the advisor `Register.toolCallModels`); a model that fails the canary is served exactly as before, just without tool calls. Eligibility is RESTRICTED to the curated 'top models' the provider knows a tool-call parser pairing for — models outside that set never attempt tool calling even when this is on, so turning it on can only ADD capability, never break existing serving. Absent ≡ off: no engine advertises tool calls and the machine behaves exactly as it does today. Optional / additive; pre-2026-07 agents ignore it.\nNote: an operator may still force the raw vLLM passthrough on any model via the `COCORE_ENABLE_TOOL_CALLS` env var; this field is the curated, UI-driven path that does not require a known global parser."
97 + 
          },
78 98 
          "trustLevel": {
79 99 
            "ref": "dev.cocore.compute.defs#trustLevel",
80 100 
            "type": "ref"
81 101 
          },
102 + 
          "desiredTier": {
103 + 
            "ref": "dev.cocore.compute.defs#tier",
104 + 
            "type": "ref",
105 + 
            "description": "The confidentiality tier the OWNER has opted this machine into, set from a management UI (the console / tray 'Upgrade security' action). Mirrors `desiredModels`: owner-written INTENT, the agent reconciles toward it (e.g. switches to the measured native engine and earns the hardware-attested posture). Setting `attested-confidential` NEVER fakes the achieved state — the agent only publishes the higher `tier`/`trustLevel` once it actually earns them, and a machine that can't (e.g. not a native build) stays best-effort with a surfaced reason. Absent / `best-effort` means the owner has not opted into confidential and the machine serves exactly as before — opting in is the only thing that changes anything. Owner-written, agent-preserved. Optional / additive; pre-0.9.19 agents ignore it."
106 + 
          },
82 107 
          "engineFault": {
83 108 
            "type": "object",
84 109 
            "required": [
85 110 
              "code",
86 111 
              "message",
87 112 
              "at"
88 113 
            ],
89 114 
            "properties": {
90 115 
              "at": {
91 116 
                "type": "string",
92 117 
                "format": "datetime",
93 118 
                "description": "When the agent gave up and recorded the fault."
94 119 
              },
95 120 
              "code": {
96 121 
                "type": "string",
97 122 
                "maxLength": 64,
98 123 
                "description": "Machine-readable fault class: `model-load-failed` (the inference subprocess never became ready), `venv-missing` (the Python environment is absent or incomplete), or `no-home` (the agent could not locate its state directory)."
99 124 
              },
100 125 
              "models": {
101 126 
                "type": "array",
102 127 
                "items": {
103 128 
                  "type": "string",
104 129 
                  "maxLength": 256
105 130 
                },
106 131 
                "maxLength": 256,
107 132 
                "description": "The configured model identifiers that failed to load."
108 133 
              },
109 134 
              "message": {
110 135 
                "type": "string",
111 136 
                "maxLength": 600,
112 137 
                "description": "Human-readable, content-safe summary with remediation guidance. Never contains prompt or completion bytes (faults are recorded before any job is served)."
113 138 
              }
114 139 
            },
115 140 
            "description": "Present when the agent could not bring its configured inference engine online after exhausting its startup recovery attempts. The machine still appears (and may still serve the no-op `stub` engine), but it will NOT be routed real inference jobs because its `supportedModels` does not include the configured model. Consumers SHOULD surface this to the operator as a fault with remediation guidance. Absence means the engine loaded cleanly (the agent clears this field on every healthy serve). Additive / optional — pre-2026-06 readers ignore it."
116 141 
          },
142 + 
          "advisorFault": {
143 + 
            "type": "object",
144 + 
            "required": [
145 + 
              "code",
146 + 
              "message",
147 + 
              "observedAt"
148 + 
            ],
149 + 
            "properties": {
150 + 
              "code": {
151 + 
                "type": "string",
152 + 
                "maxLength": 64,
153 + 
                "description": "Machine-readable fault class; see the field description for known values. Unknown codes MUST be treated as a generic advisor-unreachable fault."
154 + 
              },
155 + 
              "message": {
156 + 
                "type": "string",
157 + 
                "maxLength": 600,
158 + 
                "description": "Human-readable, content-safe summary with remediation guidance. Carries only the classified error kind — never raw error text, URLs, or credentials."
159 + 
              },
160 + 
              "observedAt": {
161 + 
                "type": "string",
162 + 
                "format": "datetime",
163 + 
                "description": "When the agent recorded the fault (RFC3339, UTC)."
164 + 
              }
165 + 
            },
166 + 
            "description": "Present when the agent cannot establish its WebSocket connection to its advisor (matchmaker) after repeated consecutive attempts. The machine may be perfectly healthy locally — engine loaded, records published, `serving: true` — yet completely absent from the network: no advisor registry entry, no jobs routed, and without this field the failure is invisible remotely (the record looks like a healthy idle machine, so operators misdiagnose it as an onboarding problem). Consumers SHOULD surface this as 'serving locally but cannot reach the network' with remediation guidance (VPN / firewall / WebSocket filtering). Known codes: `dns-failure`, `tls-failure`, `connect-timeout`, `connect-refused`, `upgrade-blocked` (plain HTTPS to the advisor works but the WebSocket upgrade cannot be established — a middlebox on the network is filtering WebSockets), `http-<status>` (the upgrade handshake got a non-101 HTTP answer), `closed-<code>` (the socket was closed with the given WebSocket close code), and `network-unreachable`; new codes may be added, and consumers MUST treat an unknown code as a generic advisor-unreachable fault. The agent publishes this through its record-write path over plain HTTPS — which is exactly the transport that still works in the failure this diagnoses — and clears the field on its next successful advisor registration, so presence reflects the current state, not a stale failure. Additive / optional — pre-2026-07 readers ignore it."
167 + 
          },
117 168 
          "machineLabel": {
118 169 
            "type": "string",
119 170 
            "maxLength": 128,
120 171 
            "description": "Human-readable name for this machine, e.g. 'MacBook Pro M3 Max #1'."
121 172 
          },
122 173 
          "provisioning": {
123 174 
            "type": "boolean",
124 175 
            "description": "True while the agent is still coming up — it publishes this record immediately on serve start (so the machine appears right away) but before its inference engine has finished loading. The agent re-publishes with this false (or absent) once the engine is ready and it has connected to its matchmaker. Consumers SHOULD show such a machine as 'provisioning' and SHOULD NOT route jobs to it. Absence is equivalent to false."
125 176 
          },
177 + 
          "regionSource": {
178 + 
            "type": "string",
179 + 
            "maxLength": 32,
180 + 
            "description": "How `region` was derived, e.g. 'ip-geo' (public-IP geolocation). Surfaces the provenance — and thus the trust ceiling — of the coarse location to consumers. Present iff `region` is present. Optional / additive."
181 + 
          },
126 182 
          "binaryVersion": {
127 183 
            "type": "string",
128 184 
            "maxLength": 64,
129 185 
            "description": "Version string of the agent binary that wrote this record (e.g. `0.3.4`). Stamped on every `cocore agent serve` startup, so the record reflects the freshest deploy. Operators / dashboards use this to spot machines that haven't been updated to a release with a known fix. Optional / additive — pre-2026-05 records won't carry it."
130 186 
          },
131 187 
          "desiredModels": {
132 188 
            "type": "array",
133 189 
            "items": {
134 190 
              "type": "string",
135 191 
              "maxLength": 256
136 192 
            },
137 193 
            "maxLength": 256,
138 194 
            "description": "Model identifiers the OWNER wants this machine to load, set from a management UI (e.g. the console's per-machine model picker). The agent reconciles toward it: on serve start it loads this set instead of its local default, and while running it restarts to reload when this set changes. Distinct from `supportedModels`, which is what actually loaded (a model that won't fit RAM stays in `desiredModels` but never appears in `supportedModels`). Owner-written, agent-preserved; absent means the agent uses its local config. Additive / optional — pre-2026-06 agents ignore it."
139 195 
          },
196 + 
          "shareLocation": {
197 + 
            "type": "boolean",
198 + 
            "description": "The owner's opt-in to publishing this machine's coarse country. Owner-written INTENT, set from a management UI (the console's per-machine settings), like `desiredModels`/`desiredTier`/`active`: the agent reconciles toward it but NEVER authors it, so it must PRESERVE whatever it finds on every re-publish. When `true`, the agent resolves this machine's country from a best-effort public-IP geolocation at serve start and stamps `region`/`regionSource`/`regionObservedAt`; when absent/`false` it omits those fields, so turning sharing off drops any previously-shared value on the next re-publish (opt-out clears the data). Absent ≡ not sharing. Optional / additive; pre-2026-06 agents ignore it."
199 + 
          },
140 200 
          "payoutsEnabled": {
141 201 
            "type": "boolean",
142 202 
            "description": "True iff the provider has completed payout onboarding with at least one exchange and that exchange has confirmed it can transfer funds to them. Matchmakers SHOULD filter paid jobs away from providers where this is false; self-loop jobs (requester == provider) and free-tier jobs are unaffected. Absence is equivalent to false. The exchange asserts this from its own side via the corresponding paymentAccount record; this field exists so consumers don't have to do a second lookup to know whether the provider can be paid."
143 203 
          },
144 204 
          "contactEndpoint": {
145 205 
            "type": "string",
146 206 
            "format": "uri",
147 207 
            "description": "URL of the advisor / matchmaking service this provider currently uses. Federable; may change without invalidating prior receipts."
148 208 
          },
149 209 
          "modelIdentifier": {
150 210 
            "type": "string",
151 211 
            "maxLength": 64,
152 212 
            "description": "Apple model code, e.g. 'Macmini9,1' or 'Mac15,3'. Stable across OS updates and useful for hardware-class matching."
153 213 
          },
154 214 
          "supportedModels": {
155 215 
            "type": "array",
156 216 
            "items": {
157 217 
              "type": "string",
158 218 
              "maxLength": 256
159 219 
            },
160 220 
            "maxLength": 256,
161 221 
            "minLength": 1,
162 222 
            "description": "Opaque model identifiers honored by this provider."
163 223 
          },
224 + 
          "attestationFault": {
225 + 
            "type": "object",
226 + 
            "required": [
227 + 
              "code",
228 + 
              "message",
229 + 
              "at"
230 + 
            ],
231 + 
            "properties": {
232 + 
              "at": {
233 + 
                "type": "string",
234 + 
                "format": "datetime",
235 + 
                "description": "When the agent recorded the fault."
236 + 
              },
237 + 
              "code": {
238 + 
                "type": "string",
239 + 
                "maxLength": 64,
240 + 
                "description": "Machine-readable fault class: `attestation-publish-failed` (the record could not be written to the PDS) or `attestation-build-failed` (the signed record could not be assembled)."
241 + 
              },
242 + 
              "message": {
243 + 
                "type": "string",
244 + 
                "maxLength": 600,
245 + 
                "description": "Human-readable, content-safe summary with remediation guidance. Never contains prompt or completion bytes."
246 + 
              }
247 + 
            },
248 + 
            "description": "Present when the agent could not build or publish its `dev.cocore.compute.attestation` record. The machine still appears and may still answer inference, but it will NOT produce verifiable receipts (a receipt strong-refs an attestation; without a published one there is nothing to reference), so it stays effectively self-attested even when the hardware would support more. Consumers SHOULD surface this to the operator as a fault with remediation guidance — without it, a publish failure is invisible and the machine merely looks idle. Absence means the attestation published cleanly (the agent clears this field on every successful (re-)attestation). Additive / optional — pre-2026-06 readers ignore it."
249 + 
          },
164 250 
          "encryptionPubKey": {
165 251 
            "type": "string",
166 252 
            "maxLength": 128,
167 253 
            "description": "X25519 public key (base64) used to wrap requests to this provider."
168 254 
          },
255 + 
          "regionObservedAt": {
256 + 
            "type": "string",
257 + 
            "format": "datetime",
258 + 
            "description": "When `region` was observed during the current serve (RFC3339, UTC). Because the agent re-stamps on every serve, this doubles as a freshness signal for the coarse location. Present iff `region` is present. Optional / additive."
259 + 
          },
169 260 
          "acceptedExchanges": {
170 261 
            "type": "array",
171 262 
            "items": {
172 263 
              "type": "string",
173 264 
              "format": "did"
174 265 
            },
175 266 
            "maxLength": 64,
176 267 
            "description": "Exchange DIDs this provider will accept settlement from. Empty/absent means any exchange is acceptable."
177 268 
          },
178 269 
          "attestationPubKey": {
179 270 
            "type": "string",
180 271 
            "maxLength": 256,
181 272 
            "description": "P-256 public key (base64) bound to this machine's Secure Enclave. Used to verify attestation and receipt signatures. Doubles as the stable per-machine fingerprint: the SE keypair is generated once at first agent boot and survives reboots / re-pairs / OS updates, so two records with the same `attestationPubKey` describe the same physical machine. Agents reuse the rkey of any existing record with this same key (and delete duplicates) instead of creating a fresh provider record per `serve` invocation, so the on-PDS view stays one record per machine."
182 273 
          },
183 274 
          "memoryBandwidthGBs": {
184 275 
            "type": "integer",
185 276 
            "minimum": 0,
186 277 
            "description": "Reported memory bandwidth in GB/s, when applicable."
187 278 
          }
188 279 
        }
189 280 
      }
281 + 
    },
282 + 
    "proBonoPolicy": {
283 + 
      "type": "object",
284 + 
      "required": [
285 + 
        "mode"
286 + 
      ],
287 + 
      "properties": {
288 + 
        "dids": {
289 + 
          "type": "array",
290 + 
          "items": {
291 + 
            "type": "string",
292 + 
            "format": "did"
293 + 
          },
294 + 
          "maxLength": 1024,
295 + 
          "description": "Requester DIDs this machine serves pro bono when `mode` is `direct` — the owner's explicit pro-bono relationships. Ignored when `mode` is `any` (everyone is already free). Empty/absent under `direct` means the machine currently serves no one pro bono (every job is paid), which is the safe default for a half-configured policy."
296 + 
        },
297 + 
        "mode": {
298 + 
          "type": "string",
299 + 
          "description": "`any`: serve every requester pro bono. `direct`: serve only the requesters in `dids` pro bono; all others are normal paid jobs.",
300 + 
          "knownValues": [
301 + 
            "any",
302 + 
            "direct"
303 + 
          ]
304 + 
        }
305 + 
      },
306 + 
      "description": "How this machine holds itself out for pro-bono (free, unmetered, no-cut) work. `mode: any` opts the machine into pro bono for EVERY requester — held out for any pro-bono work. `mode: direct` restricts the carve-out to the requesters listed in `dids` — the owner's direct pro-bono relationships — and serves everyone else as a normal paid job. An absent policy (or an unknown `mode` a reader doesn't understand) means pro bono is off and the machine bills normally; readers MUST fail closed to paid rather than assume free."
190 307 
    }
191 308 
  },
192 309 
  "$type": "com.atproto.lexicon.schema",
193 310 
  "lexicon": 1,
194 311 
  "description": "A compute provider's public profile. One record per physical machine. The DID owning the record is the provider's billable identity; the same DID may own multiple provider records (one per machine)."
195 312 
}

Compare Other Versions

Lexicon Garden

@